mirror of
https://github.com/hanzoai/compute.git
synced 2026-10-30 14:50:41 +00:00
zeekayandHanzo Dev
70371d4941
visor required github.com/hanzoai/iam-v1 DIRECTLY (go.mod, 6 import sites)
while ALSO linking github.com/hanzoai/iam through cloud. One binary, both
implementations of the same idea.
iam-v1 is ARCHIVED. Its description says "no longer in any graph"; go list -deps
said otherwise. An archived repo cannot take a push, so it cannot take a
security fix — which disqualifies it as a dependency of a deployed service no
matter how good the code inside is.
The code inside is, in fact, the same code. iam-v1's ROOT package is a copy of
the Casdoor Go SDK that also lives, extracted and maintained, at
github.com/hanzoai/iamsdk/v2/iamsdk: 67 of 73 non-test files byte-identical
once the package clause is normalised. Same shape, same bounded context, same
semantics — a genuine duplicate, not a name collision, so it collapses.
Measured before landing this, so the swap drops nothing:
- ParseJwtToken + publicKeyFromPEM: byte-identical. Signature verification,
the JWKS-then-cert-PEM fallback, the algorithm allowlist — unchanged.
- jwks.go: byte-identical. Key fetch unchanged.
- iamsdk's User is a strict superset of iam-v1's.
- Zero exported symbols exist there and not here.
- What iam-v1 had and iamsdk lacked — Claims.Orgs and Claims.BillingAccount,
both signed and both minted by live IAM — went into iamsdk v2.2.1 first,
with tests. Nothing was dropped to make the merge fit.
- iam-v1's root errors.go sentinels are NOT ported: nothing in that module
ever returns them. (teamrole.ErrCrossOrg is a different package's live
guard, and visor never imported that subpackage.) Dead names, not guards.
No shim, no alias: the import is plain `iamsdk`, spelled once. The old
`iam "…/iam-v1"` alias is what let two lineages wear one name at the call site.
visor's own guards are untouched — GetBearerUser still fails closed on an empty
owner and still refuses a sibling brand's issuer; authz.IsAllowed is unchanged.
deps_test.go stops the archived module coming back, reading go.mod rather than
imports so a TRANSITIVE reintroduction fails too, and TestRetiredInDetects
proves the detector fires on the exact require line this commit deletes.
Gate: go build ./... + go vet ./... + go test ./... green before and after.
go list -deps ./... | grep hanzoai/iam-v1 → 1 package before, 0 after; go.sum
references → 0.
Co-authored-by: Hanzo Dev <[email protected]>
47 lines
1.7 KiB
Go
47 lines
1.7 KiB
Go
// Copyright 2023 Hanzo Industries Inc. All Rights Reserved.
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
|
|
package service
|
|
|
|
import (
|
|
"github.com/hanzoai/iamsdk/v2/iamsdk"
|
|
)
|
|
|
|
// botuser.go — a launched bot IS an org member. registerBotUser creates an IAM
|
|
// user for each machine at launch so the bot shows up as a user everywhere IAM
|
|
// identities surface — notably the hanzo.team roster — instead of on a separate
|
|
// bot dashboard. The bot is a passwordless "service-account" tagged "agent": it
|
|
// never logs in interactively; it authenticates to the gateway by token.
|
|
//
|
|
// Best-effort by design: a registration failure never fails the launch (the
|
|
// machine + bot still run; the identity reconciles later). Idempotent — a
|
|
// re-launch of a same-named fleet member no-ops on the existing user. IAM is
|
|
// configured at startup (controllers.InitAuthConfig -> iamsdk.InitConfig), so the
|
|
// global client is ready by the time any launch runs.
|
|
func registerBotUser(org, name, displayName string) {
|
|
if org == "" || name == "" {
|
|
return
|
|
}
|
|
if displayName == "" {
|
|
displayName = name
|
|
}
|
|
_, _ = iamsdk.AddUser(&iamsdk.User{
|
|
Owner: org,
|
|
Name: name,
|
|
DisplayName: displayName,
|
|
Type: "service-account",
|
|
Tag: "agent",
|
|
})
|
|
}
|